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The Legislative Audit Committee 
of the Montana State Legislature: 


This is our performance audit of the efforts by the Department of Public Health and 
Human Services to reduce fraud, waste, and abuse in the Montana Medicaid program. 


This report provides the Legislature information about efforts by the department 
to mitigate the risk of fraud, waste, and abuse in the Montana Medicaid program. 
This report includes recommendations for improving controls within the department 
for identifying and pursuing potential Medicaid fraud, waste, and abuse. A written 
response from the department is included at the end of the report. 


We wish to express our appreciation to the director and her staff for their cooperation 
and assistance during the audit. 


Respectfully submitted, 
/s/ Angus Maciver 


Angus Maciver 
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PERFORMANCE AUDIT 


State Efforts to Mitigate Fraud, Waste, 
and Abuse in the Montana Medicaid 


MOoNntTANA LEGISLATIVE AUDIT DIVISION 


Department of Public Health and Human Services 


17P-02 REPORT SUMMARY 


The Department of Public Health and Human Services is responsible 
for administering the Medicaid program in Montana. Over 20 percent of 
Montana’s population is enrolled in Medicaid, and the state’s share of the 
cost of the program is estimated to be approximately $915 million for the 
2019 biennium. The department is responsible for safeguarding the program 
from fraud, waste, and abuse by both providers and recipients. While 
the department has controls in place, changes are needed to improve the 
state’s ability to identify and pursue fraud, waste, and abuse. Without these 
improvements, fraud, waste, and abuse by providers and recipients could go 


undetected by the department. 


Context 


Medicaid is a jointly funded federal and 
state program for health care services for 
certain low-income and other eligible groups. 
Medicaid is an important program in Montana 
as the state’s share of the cost of Medicaid 
services is estimated to be about $915 million 
for the 2019 biennium, and over 20 percent 
of the population of Montana is enrolled in 
the program. When fraud, waste, and abuse 
occur in Medicaid, it not only increases costs 
to state and federal governments, but it results 
in federal and state taxpayer dollars being spent 
inappropriately. Because of this, increasing 
attention has been directed to addressing 
fraud, waste, and abuse in the Medicaid 
program. While states must safeguard the 
Medicaid program from fraud, waste, and 
abuse, these controls take up state resources 
that could be otherwise used in the program. 
‘Therefore, states must strike the right balance 
between combatting fraud, waste, and abuse in 
Medicaid with other needs in the program. 


In Montana, multiple divisions and functions 
within the Department of Public Health 
and Human Services (department) conduct 
activities to address fraud, waste, and abuse in 
the Medicaid program. Some of these activities 
are associated with Medicaid recipients, 
while others are associated with Medicaid 
providers. Audit work examined whether the 
department’s efforts to identify and pursue 
indications of potential fraud or abuse by 
providers and recipients are conducted in 
accordance with federal and state requirements 
and best practices. Audit work also examined 
the coordination of efforts within the 
department and between the department, its 
contractors, and other state entities. While our 
work was not intended or designed to identify 
specific instances of fraud or abuse by recipients 
or providers, we did evaluate the department's 
efforts and controls in this area. 


(continued on back) 
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Results 


Our audit found the department has policies 
and controls in place to identify fraud and 


abuse in the Montana Medicaid program. 


However, the audit identified the need for 
the department to reconsider policy decisions 
and strengthen its controls in certain areas to 
reduce vulnerability to fraud and abuse. The 
audit found several improvements that should 
be made in identifying and pursuing fraud 
and abuse by both Medicaid providers and 
Medicaid recipients. The audit includes six 
recommendations to the department and one 
recommendation to the Montana Legislature. 
Recommendations to the department include: 


¢  Re-evaluating the state’s Medicaid 
recipient eligibility _ verification 
policies to reduce vulnerability to 
recipient fraud and abuse. 


¢ Additional training for Medicaid 
eligibility workers on how to address 
potential recipient fraud and abuse. 


¢ Using state tax information to better 
investigate complaints of Medicaid 
recipient fraud. 


¢ Ensuring Medicaid providers are 
revalidated within the federally 
required time frames. 


¢ Developing a more risk-based and 
systematic approach in auditing 
Medicaid providers. 


¢ Developing an overall strategy for 
addressing Medicaid provider fraud 


and abuse. 


There is also a recommendation to the 
Legislature to amend current state law to 
address certain restrictions on audits of 
Medicaid providers by the department and its 
contractors. 


Recommendation Concurrence 


Source: Agency audit response included in 
final report. 


For a complete copy of the report (17P-02) or for further information, contact the 
Legislative Audit Division at 406-444-3122; e-mail to lad@mt.gov; or check the web site at 


http://leg.mt.gov/audit 
Report Fraud, Waste, and Abuse to the Legislative Auditor's FRAUD HOTLINE 


Call toll-free 1-800-222-4446, or e-mail lad@mt.gov. 


Chapter | — Introduction 


Introduction 


Medicaid is a jointly funded federal and state program for health care services for 
certain low-income and other eligible groups. The Medicaid program in Montana 
is administered at the state level by the Department of Public Health and Human 
Services (department) through a state plan approved by the federal Centers for Medicare 
& Medicaid Services (CMS). Medicaid is an important program in Montana as the 
state’s share of the cost for Medicaid services is estimated to be about $915 million 
for the 2019 biennium, and around 230,000 Montanans are enrolled in the program. 
When fraud, waste, and abuse occur in Medicaid, it not only increases costs to state 
and federal governments, but it results in federal and state taxpayer dollars being spent 
inappropriately. Because of this, increasing attention has been directed to addressing 
fraud, waste, and abuse in Medicaid at both the federal and state levels. Collectively, the 
reduction of fraud, waste, and abuse in Medicaid is called Medicaid program integrity. 
The Legislative Audit Committee prioritized a performance audit of the integrity of 
the Montana Medicaid program. This chapter identifies where the primary Medicaid 
program integrity efforts currently exist in Montana as well as the scope, objectives, 
and methodologies of our audit. 


Medicaid Program Integrity Terms 


Federal regulations require the department to have methods and criteria for identifying, 
investigating, and referring suspected recipient and provider fraud. To understand this 
requirement, it is important to recognize the distinction between fraud and waste and 
abuse in Medicaid and what constitutes a credible allegation of fraud. Below are the 
definitions of these terms: 


Fraud: Federal regulations define fraud as an intentional deception or 
misrepresentation made by a person with the knowledge that the deception 
could result in some unauthorized benefit to himself or some other person. It 
includes any act that constitutes fraud under applicable federal or state law. 
An example of provider fraud is billing for Medicaid services that were not 
performed. Individuals falsifying information pertaining to their eligibility 
when applying for Medicaid is an example of recipient fraud. 


Abuse: Abuse is defined in federal regulations as provider practices that are 
inconsistent with sound fiscal, business, or medical practices. Abuse results 
in unnecessary costs to the Medicaid program or in reimbursement for 
services that are not medically necessary or that fail to meet professionally 
recognized standards for health care. Abuse involves taking advantage of 
loopholes or bending the rules. Abuse also includes recipient practices that 
result in unnecessary cost to the Medicaid program. An example of abuse 
by providers is billing Medicaid for unnecessary health services. An example 
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of abuse by recipients is excessive use of emergency services for nonemergent 
care. 


Waste: While not defined in federal regulations, waste includes inappropriate 
use of services and misuse of resources. Waste is not a criminal or intentional 
act. An example of waste in the Medicaid program is duplication of tests that 
can occur when providers do not share information with each other. 


Credible Allegation of Fraud: Federal regulations define a credible allegation 
of fraud as an allegation, which has been verified by the state, from any 
source, including but not limited to a) fraud hotline complaints; b) claims 
data mining; and c) patterns identified through provider audits, civil false 
claims cases, and law enforcement investigations. Allegations are considered 
credible when they have indications of reliability and the state Medicaid 
agency has reviewed all allegations, facts, and evidence carefully and acts 
judiciously on a case-by-case basis. 


Montana defines Medicaid fraud in §45-6-313, MCA. Individuals commit Medicaid 
fraud when they obtain Medicaid payments or benefits by purposely or knowingly 
submitting false or misleading claims, applications, or other documents to obtain a 
service or item to which they are not entitled. 


Fraud, waste, and abuse in the Medicaid program result in federal and state taxpayer 
dollars being spent inappropriately. Federal and state entities work to curb fraud, waste, 
and abuse in the Medicaid program through a variety of program integrity efforts. The 
following section describes typical Medicaid program integrity efforts and the entities 
responsible for them. 


Medicaid Program Integrity Background and Organization 


The Government Accountability Office (GAO) emphasizes reducing the risk of fraud, 
waste, and abuse in the Medicaid program by focusing on preventing them from 
happening in the first place. The recommended model includes program integrity 
controls aimed at prevention, detection, and monitoring, as well as investigation and 
prosecution that ultimately lead to improved preventive controls. Figure 1 (see page 3) 
depicts this model. 


Figure 1 
Recommended Model for Anti-Fraud Controls 


Potential fraud, Potential fraud, ; Potential fraud 
waste, and abuse waste, and abuse mple: 


Lessons learned influence future use of preventive controls 


Pll 


Source: Compiled by the Legislative Audit Division from the GAO. 


The recommended model emphasizes the importance of preventive controls in 
reducing fraud, waste, and abuse in the Medicaid program. Examples of preventive 
controls are screening providers prior to participation in the Medicaid program and 
making correct determinations of recipient eligibility. If fraud, waste, or abuse bypass 
these preventive controls, detection and monitoring controls then become essential. 
Examples of detection controls include auditing claims paid to providers to ensure they 
were billed according to the rules of the program, and verifying recipient eligibility 
after enrollment. If potential fraud has been detected, investigation and prosecution are 
the final steps in addressing it. Rather than relying on investigation and prosecution to 
curb fraud in the Medicaid program, the recommended model highlights the need to 
improve preventive controls based on lessons learned throughout the process. 


States are allowed considerable flexibility in structuring their Medicaid programs 
within broad federal parameters, including some aspects of program integrity controls. 
Typical program integrity controls in state Medicaid programs include a variety of 
activities to ensure that: 


¢ Recipient eligibility decisions are made correctly. 


¢ Prospective and enrolled providers meet federal and state participation 
requirements. 


¢ — Services provided to recipients are medically necessary and appropriate. 


¢ Provider payments are made in the correct amounts and for appropriate 
services. 


This report discusses some of the main program integrity controls within the 
department and includes recommendations for improving them. 
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Both state and federal entities engage in Medicaid program integrity activities. 
Oversight and program support for state Medicaid programs are provided at the 
federal level by CMS within the U.S. Department of Health and Human Services. 
At the state level, the two divisions within the department with the most active roles 
in Medicaid program integrity are the Human and Community Services Division 
(HCSD) and the Quality Assurance Division (QAD). There are Medicaid activities in 
other branches within the department, but they focus more on the administration of 
the Medicaid program and play a less direct role in program integrity activities. The 
HCSD and QAD are highlighted in the department’s organizational chart presented 
in Figure 2, and their roles in ensuring the integrity of the Medicaid program are 
summarized below. 


Figure 2 
Department of Public Health and Human Services Organizational Chart 


Director 


Public Health and 
Safety Division 


Operations Services Medicaid & Health Economic Security 
Branch Services Branch Services Branch 


ee eee a ae el 


Business & Disability Human & Child Support Chi F 

i hild & Famil 

Financial Services Say ASSUMES s Heese Employment & Community Enforcement Benen ae 
Division el sales act cl Transitions Division] | Services Division Division 


Certification Policy 
Bureau 


Licensure System 
Bureau Operations 


Program 
Compliance 
Bureau 


Program Early Childhood 
Support Services Bureau 


Intergovernmental 
Human Services 
Bureau 


Fiscal Bureau 


Source: Compiled by the Legislative Audit Division from department information. 


¢ The Human and Community Services Division is responsible for recipient 
eligibility and enrollment in Medicaid and other public assistance programs. 
There are 20 Offices of Public Assistance and processing centers throughout 


the state that process and determine eligibility for the majority of Medicaid 
applications in Montana. A contracted information system called the 
Combined Healthcare Information and Montana Eligibility System — 
Enterprise Architecture (CHIMES-EA) is used to manage recipient eligibility 
information. The system also performs certain automated enrollment and 
eligibility renewal functions, such as electronic checks against various 
databases. 


¢ The Quality Assurance Division is responsible for investigating allegations of 
recipient fraud in public assistance programs, including Medicaid. QAD also 
conducts retrospective audits of claims paid to Medicaid providers within 
its Surveillance and Utilization Review Section (SURS) in the Program 
Compliance Bureau in order to identify potential overpayments due to fraud, 
waste, and abuse. The SURS unit also oversees the screening and enrollment 
of Medicaid providers. However, most of the routine provider screening and 
enrollment activities are conducted by the contractor for the Medicaid claims 
processing system, the Medicaid Management Information System (MMIS). 


Federal regulations require the department to refer cases of suspected provider fraud to 
the state Medicaid Fraud Control Unit (MFCU). MFCU resides within the Montana 
Department of Justice and is overseen at the federal level by the U.S. Department of 
Health and Human Services Office of the Inspector General. MFCU has jurisdiction 
over cases related to provider fraud and abuse or neglect of patients in health care 
facilities receiving payment from Montana Medicaid. It does not investigate claims of 
Medicaid recipient fraud. 


Audit Scope 


Through audit assessment work, we identified areas of potential risk in the department’s 
efforts to address fraud and abuse in the Medicaid program. The scope of these efforts 
included the department's prevention, detection, and investigation processes. Audit 
assessment and planning work identified risks in these processes related to both 
Medicaid recipients and providers. Since HCSD and QAD conduct the most direct 
program integrity activities in these areas, audit work largely focused on these two 
divisions. This work also involved field offices and contractors under these divisions. 


Program integrity efforts include multiple divisions within the department as well as 
contractors and other outside entities, such as MFCU. Because of this, we also identified 
potential risk in the coordination of program integrity efforts by the department. While 
we did conduct work involving investigation activities by the department, we did not 
examine the effectiveness of the investigation and prosecution process conducted by 
MEFCU after it receives referrals from the department. 
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Audit work included several data analyses and file review methodologies. These 
generally focused on data and files from fiscal years 2016 and 2017 and involved 
information on both Medicaid providers and recipients. While data analysis and file 
review were conducted as part of audit work, our work was not intended or designed 
to identify specific instances of Medicaid fraud by either providers or recipients, as this 
would have required detailed investigation into individual cases. Rather, audit work 
was designed to examine the department’s controls in identifying and pursuing fraud 
and abuse in the Medicaid program and the coordination of those efforts. 


Audit Objectives 


Based on audit assessment work, we developed the following three objectives for 
examining program integrity activities in the Montana Medicaid program: 


1. Does the department identify and pursue indications of potential fraud 
and abuse by Medicaid recipients in accordance with federal and state 
requirements and best practices? 


2. Does the department identify and pursue indications of potential fraud 
and abuse by Medicaid providers in accordance with federal and state 
requirements and best practices? 


3. Does the department ensure the integrity of the Medicaid program through 
coordination of efforts across state functions and referrals of suspected 
fraud and abuse in accordance with federal and state requirements and best 
practices? 


Audit Methodologies 


To address our three audit objectives, the following work was conducted: 


¢ — Reviewed federal and state laws, rules, and regulations that govern activities 
related to the audit objectives. 


¢ Reviewed other professional guidance and best practices for Medicaid 
program integrity from sources such as the Medicaid and CHIP Payment 
and Access Commission (MACPAC) and the U.S. GAO. 


¢ — Reviewed the department’s mission, goals, policies, and procedures related to 
the administration of the Montana Medicaid program. 


¢ — Interviewed department management and other staff responsible for various 
program integrity activities, including recipient eligibility and enrollment, 
provider screening and enrollment, and post-payment claim reviews. 


¢ Surveyed the state’s population of 401 Medicaid eligibility workers in order 
to understand their role in addressing potential Medicaid recipient fraud. We 
received 255 responses to the survey for a response rate of 64 percent. 


¢ Reviewed data on recipient fraud hotline calls, investigations by the 
department, and recipient overpayments. 


¢ Based on a comparison of Medicaid eligibility data with 2016 state tax 
data, we reviewed a random sample of 100 individuals from a subgroup of 
Medicaid recipients issued Medicaid benefits in May 2017 to review the 
department’s eligibility verification processes. 


¢ Analyzed data and conducted file review on a random sample of 
100 Medicaid providers enrolled in Medicaid in January 2018 to examine 
the provider screening and enrollment processes. 


¢ — Interviewed members of two Montana provider associations with members 
participating in the Medicaid program to determine whether challenges exist 
in Medicaid program integrity processes that involve providers. 


¢ Analyzed data and conducted file review on a random sample of 
110 post-payment claim audits conducted by the SURS unit within the 
department. 


¢ = Interviewed MFCU staff to understand the extent and nature of coordination 
between the department and the MFCU. 


¢ Obtained and reviewed the MMIS contract and interviewed MMIS 
contractor staff to review coordination between the contractor and the 
department related to addressing provider fraud and abuse. 


¢ — Interviewed Medicaid staff from six other states comparable to Montana on 
their Medicaid service delivery model, Medicaid spending and enrollment, 
and rural-urban distribution. The states interviewed included Alaska, 
Colorado, Idaho, South Dakota, Vermont, and Wyoming. 


Management Memorandum 


A management memorandum is a verbal or written notification to the agency of issues 
that should be considered by management, but do not require formal agency response. 
During the audit, we discussed an issue with the department related to the collection of 
overpayments from Medicaid recipients. The department currently directs its eligibility 
workers in its business processes to recoup money for services rendered while a recipient 
was ineligible or when benefits have been used fraudulently. Per our discussions and 
clarifications with CMS, state Medicaid agencies should not be collecting repayment 
from recipients for Medicaid services that were rendered, even if the recipient was 
enrolled fraudulently or was ineligible at the time of service. However, if a Medicaid 
recipient is convicted for fraud in a criminal court, the recipient can be fined up to 
$25,000 or imprisoned for up to five years. CMS indicated it is currently drafting 
additional guidance regarding Medicaid recipient overpayments and the circumstances 
under which states can terminate Medicaid benefits. 


Montana Legislative Audit Division 


Issues for Further Study 


Our work with the department and its contractors identified two issues that may 


warrant future audit work: 


° 


We identified a system defect during our file review of Medicaid eligibility 
verification within CHIMES-EA. The system, in specific scenarios, was not 
correctly flagging mismatched recipient income at eligibility renewal and 
alerting eligibility workers to follow up on the discrepancy. After notifying 
the department of this system defect during the audit, the department 
indicated the issue was fixed in November 2017. Our office conducted an 
information systems audit of CHIMES-EA in 2015, but the audit focused 
on other public assistance programs and did not include Medicaid. As such, 
a review of CHIMES-EA specific to Medicaid from an information system 
perspective is a matter for further consideration. 


The department can prevent payment to providers on certain claims that 
have been billed in error or that are fraudulent using edits within MMIS. 
Edits in Medicaid are pre-payment processes within MMIS for determining 
the validity and acceptability of Medicaid claims submitted by providers. 
For example, an edit in MMIS would prevent payment on maternity care 
billed for a male recipient. While these edits prevent many billing errors, 
they cannot prevent all billing errors. Interviews with provider associations 
in Montana with members participating in Medicaid identified this as a 
source of frustration. Providers believed there was more opportunity for the 
department to prevent common billing errors. While our audit work did 
review how edits are coordinated between the department and its contractor, 
this audit did not test the completeness or effectiveness of the edits within 


MMIS. 


Report Contents 


The remainder of this report discusses our analysis of the objectives and includes 


chapters detailing our findings, conclusions, and recommendations in the following 


areas: 


¢ 


Chapter II contains additional background on program integrity activities 
related to Medicaid recipients. The chapter also includes recommendations 
for improving department controls in addressing potential fraud by Medicaid 
recipients. 


Chapter III addresses our work evaluating the department’s processes for 
preventing, detecting, and investigating potential Medicaid provider fraud 
and the need for improvements in this area. 


Chapter IV discusses the coordination of Medicaid program integrity efforts 
both within the department and between the department, its contractors, 
and MFCU, and the need to develop an overall strategy related to provider 
fraud and abuse. 


Chapter II - Changes Needed in Addressing 
Medicaid Fraud by Recipients 


Introduction 


Ensuring Medicaid recipient eligibility determinations are made correctly is the first 
line of defense against recipient fraud and abuse in a state’s Medicaid program. In 
Montana, over 20 percent of the state’s population is enrolled in Medicaid, making 
correct eligibility determinations an important part of protecting the state from 
potential fraud and abuse by recipients. However, the Montana Medicaid program 
has undergone changes in recent years, some of which include important context for 
understanding program integrity efforts in regard to Medicaid recipients. This chapter 
discusses some of these changes and provides recommendations for re-evaluating 
policy decisions and improving existing controls within the Montana Department of 
Public Health and Human Services (department) related to identifying and pursuing 
potential fraud and abuse by Medicaid recipients. 


Recent Changes to the Montana Medicaid Program 

One of the biggest changes to state Medicaid programs occurred with the enactment of 
The Patient Protection and Affordable Care Act (ACA) in 2010. The ACA mandated 
many changes to recipient eligibility policies and processes for Medicaid. For example, 
the ACA replaced complex income-counting for determining financial eligibility with 
a more streamlined approach using Modified Adjusted Gross Income, which is a 
more consistent standard that considers taxable income. Another significant change 
as a result of the ACA was moving away from in-person and documentation-heavy 
enrollment processes toward online applications and electronic data checks. Together, 
these changes moved much of the responsibility for demonstrating eligibility from 
individuals to the state. The ACA went into effect in Montana in January 2014. 


The ACA also allowed states to expand coverage under Medicaid. In 2015, the 
legislature substantially changed Montana Medicaid with the passage of the Montana 
Health and Economic Livelihood Partnership (HELP) Act. The HELP Act expanded 
coverage under Montana Medicaid to low-income, non-disabled, childless adults. 
Among other provisions, the HELP Act also required enrollees to pay premiums and 
make co-payments for many services. The HELP Act allowed removal of people from 
the program, in certain circumstances, if they did not pay these premiums. Coverage 
under Medicaid expansion became available around January 2016 and the department 
has since enrolled more than 90,000 individuals into the program. The legislature 
also included language in the HELP Act recognizing the importance of additional 
safeguards against fraud, waste, and abuse in the Medicaid program. 
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The department has also had to consider budget constraints and recent budget cuts 
in administering Medicaid according to the mission of the program. The mission of 
the Montana Medicaid program is to “assure necessary medical care is available to 
all eligible Montanans within available funding resources.” One of the department's 
goals for Medicaid is to assure integrity and accountability of the program. Budget 
constraints and recent budget reductions have played a role in decision-making by the 
department in order to balance access to services with program integrity controls. One 
example of how these budget reductions have impacted the program is in the number 
of locations and staff available to process and maintain Medicaid applications. While 
there were roughly 40 Offices of Public Assistance (OPA) with around 507 full-time 
equivalent (FTE) in January 2015, there were 20 OPAs with approximately 487 FTE 
in December 2017. 


Medicaid Eligibility Verification 
Decisions by the Department 


States are permitted considerable flexibility in structuring their Medicaid programs 
within broad federal parameters. One area in which states have flexibility is in making 
decisions on certain eligibility verification policies and processes. This section discusses 
some of these decisions by the department and provides information on the current 
Medicaid eligibility verification landscape in Montana. 


Individuals can enroll in Medicaid a number of different ways: by applying online 
through the state, through the federally-facilitated marketplace (FFM), by mail, phone, 
fax, or in person at a local OPA. There are some common eligibility requirements for 
all eligibility groups, such as U.S. citizenship. However, some requirements, and the 
verification of those requirements, may differ by eligibility group. A couple examples of 
the different eligibility groups under Medicaid are Families with Dependent Children, 
which is an ACA group, and Aged/Blind/Disabled (ABD), which is a non-ACA group. 
The eligibility verification processes differ between ACA groups and non-ACA groups. 
For example, income must be verified at application and individuals are subject to 
resource limits in non-ACA eligibility groups. Countable resources include certain 
assets, such as personal checking or savings accounts. However, per CMS, states 
are required to accept self-attestation of income for enrollment in ACA eligibility 
groups, and are prohibited from requiring applicants to provide documentation unless 
self-attested information is not compatible with government and private databases. 
CMS also prohibits resource limits for ACA eligibility groups. This means low-income 
individuals may qualify for certain ACA eligibility groups, even if they have high-value 
assets. 


Department Policies Increase Risk of Recipient Fraud 


While permitted and approved by the federal government, policy decisions made 
by the department related to Medicaid eligibility verification make the Montana 
Medicaid program more susceptible to risk for recipient fraud and abuse relative to 
other states. As part of audit work, we reviewed national reports on Medicaid eligibility 
verification policies and processes in other states. We also interviewed Medicaid staff 
from six other states comparable to Montana on their Medicaid service delivery 
models, Medicaid spending and enrollment, and their rural-urban distribution. While 
Medicaid eligibility verification in Montana is similar to other states in many ways, 
Montana is unique in some areas. Below are three examples of policy decisions by the 
department that in combination make Montana unique compared to other states in 
terms of Medicaid eligibility verification: 


¢ Post-enrollment Verification: Self-attested information, when permitted 
for the specific Medicaid program, is verified against various electronic 
data sources after enrollment. This process is referred to as post-enrollment 
verification (PEV). During the PEV process, self-attested income is 
electronically checked within six months of enrollment against quarterly state 
wage data from the Montana Department of Labor and Industry (DLI). If 
the self-attested income reported at enrollment in Medicaid is not reasonably 
compatible with the income reported in DLI’s database, the Combined 
Healthcare Information and Montana Eligibility System — Enterprise 
Architecture (CHIMES-EA) system generates a case note. Self-attested 
income is considered reasonably compatible when it is within 10 percent 
of the income reported in DLI’s database. When income is not reasonably 
compatible, Medicaid eligibility workers must address the discrepancy, which 
may include requesting hard copy verification of income from recipients. 
Post-enrollment verification of income for Medicaid is not common and 
Montana is one of only seven states nationally that does not verify income 
prior to enrollment. Other states check self-attested income against electronic 
data prior to enrollment. Alaska and Vermont, for example, are Medicaid 
expansion states that check self-attested income against electronic data 
sources at application, prior to enrollment. 


¢ Determination State: The department has opted for Montana to be a 
determination state. This means the federally-facilitated marketplace (FFM) 
makes final Medicaid eligibility determinations and the state does not verify 
income information from FFM applications. Montana is one of only nine 
determination states. Thirty states have instead opted to be assessment states, 
meaning the state verifies information on FFM applications and makes the 
final Medicaid eligibility determinations. Interviews with Medicaid staff 
from non-determination states, such as Idaho and South Dakota, found 
these states made their decisions to be non-determination states based on 
concerns with the completeness and accuracy of information on applications 
from the FFM. 


¢ Continuous Eligibility for Adults: The Centers for Medicare & Medicaid 
Services (CMS) approved a waiver for Montana that, among other 
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provisions, allows for certain populations of adults to enroll in Medicaid 
under 12 months of continuous eligibility. Waivers are approvals by CMS 
to waive certain provisions of federal Medicaid law, which allow states to 
tailor their Medicaid programs. Individuals enrolled under continuous 
eligibility are enrolled in Medicaid for 12 months without having to report 
monthly changes in income or resources. However, the individual may be 
dis-enrolled from Medicaid if non-compatible income is identified during 
the PEV process and ineligibility is subsequently confirmed by an eligibility 
worker. Montana is one of only two states providing continuous eligibility 
to parents and other adults under waiver authority. This waiver is effective 
through December 31, 2022. 


Review of Medicaid Eligibility Verification 
Identified Vulnerabilities 


In examining the department's eligibility verification processes, we conducted file 
review on a random sample of 100 individuals from a subgroup of Medicaid recipients 
enrolled in Medicaid in May 2017. First, we conducted a comparison of Medicaid 
data from CHIMES-EA with 2016 state tax data from the Montana Department of 
Revenue. Our review of these data found approximately 218,000 individuals were 
issued Medicaid benefits in May 2017, including adults and children, and around 
53,000 adults from the Medicaid data were identified in the 2016 tax data as the 
primary tax filer or spouse. Almost 20,000 of these 53,000 adults (approximately 
37 percent) had zero monthly income reported in CHIMES-EA. It should be noted 
that, due to the gap in time between the Medicaid data (May 2017) and the 2016 tax 
data, it is reasonable to assume some of these individuals may have had a change in 


circumstances, such as termination of employment. 


We then selected a random sample of 100 individuals for further file review from a 
subgroup of individuals whose income and household information in CHIMES-EA 
showed “significant differences” with the information from taxes. Individuals with 
“significant differences” were defined as those having discrepancies between Medicaid 
data and tax data in both household composition (e.g. marital status or household size) 
and monthly income. Most of the individuals meeting this definition (93 percent) 
were enrolled in ACA programs. Additionally, recent federal compliance audit work 
conducted by our office (#17-14) did not include ACA programs and only included 
non-ACA programs, as federal requirements for the compliance work prohibited the 
auditors from doing so. The audit resulted in no audit findings related to non-ACA 
eligibility. Therefore, we focused our file review for this performance audit on recipients 
enrolled in ACA programs. 


In reviewing the eligibility verification process for the 100 individuals in our sample, 
we identified certain procedural errors that indicate the state is vulnerable to Medicaid 


recipient fraud in certain areas. Some of the procedural errors we identified were 
caused by CHIMES-EA and others were due to eligibility workers not processing 
cases according to department policy and procedure. Some examples of the procedural 
errors we identified during file review are shown in Table 1. 


Table 1 
Examples of Procedural Errors from a Sample of 100 Medicaid Enrollees 


Procedural Errors 


Number in the 
F sample with a 
Error 1 Sunersiy spouse shown in 
taxes and Medicaid 


Number with 
incomes not 
counting together 


Percentage out of 
number possible 


Number in the Number with no 
Sample Size sample not going reason for not 
Error 2 through PEV going through PEV 


Percentage out of 
number possible 


Number in the Number lacking 
sample flagged for timely follow-up Percentage out of 
Error 3 Sallie Size non-compatible on income number possible 
income at PEV discrepancy 


ee 


Source: Compiled by the Legislative Audit Division from file review results. 


The procedural errors we identified in reviewing our sample of 100 individuals enrolled 
in ACA programs were: 


¢ There were nine cases where the incomes of spouses were not being counted 
together. In these cases, the individuals were showing as unmarried in one 
part of CHIMES-EA, but showing as filing taxes together and claiming 
children together in another part of the system. Income for enrollment in 
ACA programs is supposed to be counted based on taxpayer household. 
Therefore, the incomes for spouses that are living together, filing taxes 
together, and claiming children together should be counted together. 


¢ There were three cases for which we could not determine the reason for the 
individual not going through the department’s PEV process as outlined 
in department procedure. It should be noted these individuals still went 
through electronic data checks at eligibility renewal at least every 12 months. 


¢ We found 34 cases in the sample that were flagged by the department during 
the PEV process for non-compatible income. Eight of these cases (24 percent) 
lacked evidence of timely follow-up by eligibility workers to resolve the 
discrepancy. In three of these eight cases, the discrepancy still remained after 
renewal of eligibility. 
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Due to the nature of our sampling methodology, the results from our file review cannot 
be projected to the entire Medicaid population. However, the discrepancies between 
Medicaid data and tax data and the procedural errors noted above point to limitations 
in some of the Medicaid eligibility verification policies and processes used by the 
department. These limitations increase vulnerability to enrolling ineligible individuals, 
including individuals who may intend to defraud the program. When ineligible people 
are enrolled in Medicaid and obtain Medicaid services, federal and state taxpayer dollars 
cover Medicaid services for people for whom they were not intended. This potentially 
leaves fewer resources for those actually eligible for benefits. While permitted and 
approved by CMS, the department has made eligibility verification policy decisions in 
Medicaid that increase vulnerability to potential recipient fraud. 


a 
CONCLUSION 


We conclude that, in addition to broad federal requirements, the department 
has made eligibility verification policy decisions that increase vulnerability to 
recipient fraud in the Montana Medicaid program. 


Eligibility Verification Policy Decisions 
Not Always Documented 


In discussions with the department regarding decisions on Medicaid eligibility 
verification policies, management indicated some of the policies were incorporated to 
minimize the administrative burden on the department in order to maintain access to 
services for recipients. For example, according to the department, it had to implement 
Medicaid expansion with few additional staff. Consequently, some eligibility 
verification policy decisions were made to preserve access to coverage for the newly- 
eligible Medicaid expansion population, though some of the policies discussed in this 
report pre-date Medicaid expansion. However, the department could not provide 
documentation as to how the policy decisions, such as opting to be a determination 
state or verifying self-attested income post-enrollment, were made, or whether risk 
for fraud and abuse was considered. According to federal standards and guidance, 
management within state Medicaid programs is responsible for managing fraud risks 
and implementing practices for mitigating those risks. An important part of any fraud 
risk framework is documenting analysis of the types of fraud risks. 


Since Medicaid expansion has been fully implemented, the Montana Medicaid 
program is unlikely to see the large increases in enrollment in the foreseeable future 
as it did when Medicaid expansion was first introduced. As such, it is an appropriate 
time for the department to re-evaluate the state's Medicaid eligibility verification 
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policies, document what factors into these decisions, and identify recipient fraud and 
abuse risks. Department officials indicated they have a process in place to document 


decision-making moving forward. 


ee 


RECOMMENDATION #1 


We recommend the Department of Public Health and Human Services 
conduct, document, and report on a re-evaluation of its current policy 
decisions on Medicaid recipient eligibility verification. Re-evaluations should: 


A. Identify risks for Medicaid recipient fraud and abuse, analyze how policy 
decisions impact those risks, and determine whether it is feasible to 
reduce those risks through policy or procedural changes. 


B. Include policies such as post-enrollment verification of income, 
coordination with the federally-facilitated marketplace, and continuous 
eligibility. 

C. Reoccur on a systematic basis after major changes in the requirements 
of the Medicaid program. 


Potential Medicaid Recipient Fraud and 
Abuse Is Addressed Inconsistently 


Eligibility workers process and maintain applications for coverage under Medicaid 
at OPA offices and processing centers throughout the state. Consequently, eligibility 
workers play an important role in protecting the Medicaid program from potential 
fraud and abuse by recipients. As part of audit work, we conducted a survey of 
401 Medicaid eligibility workers in Montana. We received 255 responses from workers 
ranging in experience level for an overall response rate of 64 percent. The survey 
included various questions related to where vulnerabilities in Medicaid recipient fraud 
or abuse exist and whether eligibility workers thought they were adequately trained on 
how to address fraud and abuse. 


While most of the survey respondents (80 percent) indicated they had been adequately 
trained on Medicaid eligibility requirements, almost half (48 percent) indicated they 
had not been adequately trained on how to address suspected Medicaid fraud or abuse. 
We also asked whether eligibility workers had ever come across a case in which they 
suspected fraud or abuse by an individual enrolled in Medicaid. Figure 3 (see page 16) 
shows that a little over half of the survey respondents (51 percent) said they had come 
across a Case at some point in time in which they suspected Medicaid fraud or abuse. 
Of this 51 percent who indicated having come across suspected Medicaid fraud or 
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abuse, only 61 percent indicated they referred the case. Cases of potential Medicaid 
recipient fraud must be referred to the department’s Quality Assurance Division 
(QAD) for investigation. 


Figure 3 
Results of Survey of Medicaid Eligibility Workers 


Have you ever come across a case in which you suspected fraud or 
abuse by an individual enrolled in Medicaid? 


mYes sNo 


/ 


Did you refer the case? 


=Yes =No 


Source: Compiled by the Legislative Audit Division from survey results. 


‘The reasons provided by respondents for not referring a case of suspected Medicaid 
fraud or abuse ranged from being unauthorized to question self-attested information 
on Medicaid applications to not knowing where to refer potential fraud cases when 
they are identified. 


Eligibility Workers Need Additional Training 
on Medicaid Fraud and Abuse 


Our survey of eligibility workers revealed the need for additional training on how 
to address potential Medicaid recipient fraud and abuse. If eligibility workers are not 
trained in this area, the risk of Medicaid recipient fraud and abuse going undetected 
by the department increases. While Medicaid providers receive payment for Medicaid 
services obtained by recipients, there is still risk associated with Medicaid recipient 
fraud. If recipient fraud goes undetected, taxpayer dollars can cover services for 
ineligible individuals, leaving fewer resources for those truly eligible. 


While the mission of the Montana Medicaid program is to ensure access to medical 
care, the department is also responsible for integrity and accountability within the 
program. As discussed in the Montana Operations Manual, an important part of 
ensuring the integrity of a program is training of staff in internal control areas, such as 
the proper identification and referral of potential fraud and abuse to QAD. During the 
audit, department staff acknowledged there were opportunities for additional training 
for eligibility workers on how to address potential fraud and abuse. According to the 
department, it has since conducted training for eligibility workers on fraud reporting 
and has incorporated it into new hire and refresher trainings. 
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RECOMMENDATION #2 


We recommend the Department of Public Health and Human Services 
incorporate training for Medicaid eligibility workers on identifying and referring 
suspected Medicaid recipient fraud or abuse into its ongoing training plan. 


cc 


Important Context in Understanding 
Medicaid Recipient Fraud 


In assessing the department’s efforts in addressing Medicaid recipient fraud, it is 
important to understand that recipient fraud in Medicaid is addressed somewhat 
differently than recipient fraud in other public assistance programs. For example, 
federal regulations provide for a clear punitive process for an intentional program 
violation (IPV) by a recipient in the Supplemental Nutrition Assistance Program 
(SNAP), including imposing a disqualification period. An IPV occurs when a recipient 
knowingly makes a false or misleading statement, misrepresents or withholds facts, or 
violates program regulations to obtain benefits illegally. 


The punitive process for IPVs in SNAP can largely be applied by the department, 
unless the violation exceeds a certain dollar amount. However, punitive measures as a 
result of fraud by Medicaid recipients, such as dis-enrollment or disqualification from 
Medicaid, can be applied only after criminal proceedings. That is, while recipients 
can be dis-enrolled from Medicaid when determined ineligible, they can only be 
dis-enrolled for fraud after a criminal conviction. Additionally, IPVs in other programs 
cannot necessarily be applied in Medicaid. That is, ifa recipient is enrolled in Medicaid 
and other public assistance programs simultaneously, an IPV in one program does not 
necessarily equate to Medicaid fraud. 
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If a recipient is convicted for Medicaid fraud, the federal Social Security Act allows for 
dis-enrollment of the individual from Medicaid. States are then permitted discretion 
as to whether to impose a disqualification period of up to a year following the 
conviction. However, the department indicated it interprets federal law as prohibiting 
disqualification of a recipient from Medicaid, even if convicted for Medicaid fraud. 
Under this interpretation, there is little incentive for the state to pursue Medicaid 
recipient fraud. We determined this was a misinterpretation by the department based 
on our review of federal law, discussions with CMS representatives, and interviews 
with Medicaid staff in other states. 


Through our interviews with Medicaid staff from six other comparable states, we found 
that many states do not impose a disqualification period from Medicaid in practice. 
Therefore, individuals who are dis-enrolled, whether for ineligibility or fraud, may 
re-enroll in Medicaid and receive services if determined eligible. Additionally, there is 
increased risk and liability to states when individuals who are eligible for benefits do 
not receive needed medical services. Therefore, there is little cost-benefit for states in 
addressing Medicaid recipient fraud, though states can and should dis-enroll individuals 
from Medicaid when determined ineligible. Audit work determined the department is 
dis-enrolling recipients for ineligibility. With that said, federal regulations still require 
the department to conduct preliminary investigations into complaints of fraud or 
abuse in order to preserve the integrity of the Medicaid program. If Medicaid recipient 
fraud is not properly investigated and referred, federal and state taxpayer dollars may 
continue to cover Medicaid services for ineligible individuals. 


Investigations by the Department Into 
Allegations of Recipient Fraud Are Limited 


Federal regulations require the department to conduct a preliminary investigation 
when it receives complaints of Medicaid fraud or abuse from any source or if it 
identifies any questionable practices. If the preliminary investigation gives reason to 
believe a recipient has abused the Medicaid program, the department must conduct 
a full investigation. The department primarily addresses recipient abuse through its 
Team Care program, requiring a recipient to see the same provider and go to the same 
pharmacy. While the Team Care program exists to address recipient abuse, our audit 
focused on how the department addresses recipient fraud related to eligibility. If there 
is reason to believe a recipient has defrauded the Medicaid program, the department 
must refer the case to law enforcement. Preliminary investigations into accusations 


of Medicaid fraud by recipients are conducted by the Intentional Program Violation 
(IPV) unit within the department’s Quality Assurance Division (QAD). The IPV 


unit administers a recipient fraud hotline that receives calls on complaints of public 
assistance fraud, including potential Medicaid recipient fraud. The hotline number is 
advertised on the department’s website. 


As part of audit work, we obtained data on recipient fraud hotline calls between 
July 2016 and August 2017. Most of the calls to the hotline were for allegations of 
fraud in other public assistance programs, such as SNAP. There were 643 hotline calls 
received during this time period, 68 of which (11 percent) referenced Medicaid. Ten 
of the 68 hotline entries referencing Medicaid indicated the case rose to the level of 
warranting an investigation by the department. None of the Medicaid hotline calls 
we reviewed resulted in referral by the department to local law enforcement. Due 
to the limited documentation supporting what review took place, we could not 
determine whether or not individual calls merited further investigation or referral to 
law enforcement. If investigations into Medicaid recipient fraud were more thoroughly 
documented, including a description of how recipient information is verified and how 
cases are concluded, resolved, or referred, the department could better support its 
fulfillment of the requirement to conduct preliminary investigations of complaints of 
Medicaid recipient fraud. 


Access to State Tax Data Will Aid in Medicaid 
Recipient Fraud Investigations 


During the audit, we identified certain limitations in the tools available to the 
department to verify information when investigating potential Medicaid recipient 
fraud. As discussed earlier in this report, the primary electronic data source used by the 
department in verifying self-attested income is quarterly income data from DLI. While 
DLI’s database contains information on both earned and unearned income, such 
as wages and unemployment insurance benefits, the incomes of certain populations 
would not be present. For example, income from self-employment is not reported in 
DLI’s database. Additionally, the department does not verify household composition 
against any electronic data sources at enrollment or in investigating potential recipient 
fraud. These types of limitations could be partially addressed if the department had 
access to state tax information when investigating recipient fraud. 


Our data analysis and file review work revealed the usefulness of having access to 
state tax data in identifying potential discrepancies in eligibility information that may 
be associated with fraud. For example, around 37 percent of the 53,000 adults on 
Medicaid in May 2017 who filed state taxes in 2016 had zero income reported in 
CHIMES-EA. Access to state tax data could help identify individuals who reported 
zero or little income to the department, but may be earning additional income through 
selfemployment. We also found that access to taxes may help identify discrepancies 


P02 


19 


20 | Montana Legislative Audit Division Legislative Audit Division 


that are not identifiable in other databases used in investigations, particularly in regard 
to household composition. In our file review of a sample of 100 recipient cases, we 
found 16 cases where a spouse was reported in the tax data, but no spouse was present 
in CHIMES-EA. There were also six cases where a person showed as a spouse in the tax 
data and was present in CHIMES-EA, but not as the spouse. Our ability to identify 
these types of discrepancies demonstrated how access to state tax data may help detect 
potential Medicaid recipient fraud. While the department does not use tax data in 
recipient fraud investigations and had concerns with doing so, state law currently 
allows for the department to access state tax data for the purposes of preventing and 
detecting public assistance fraud and abuse, provided notice to the applicant has been 


given. 


While audit work was unable to confirm that any recipients enrolled fraudulently in 
the Medicaid program, we were able to identify potential discrepancies in eligibility 
information using state tax data, such as discrepancies in marital status or income, 
that would be useful in fraud investigations. If not thoroughly investigated, potential 
recipient fraud in Medicaid could go undetected by the department. When recipient 
fraud goes undetected, federal and state taxpayer dollars might continue to pay for 
Medicaid services that are obtained by individuals who may be ineligible for those 
benefits. Therefore, it is important for the department to use resources that might help 
identify fraud, such as state tax data, when investigating potential Medicaid recipient 


fraud. 
eS SC 


RECOMMENDATION #3 


We recommend the Department of Public Health and Human Services 
enhance investigations into complaints of Medicaid recipient fraud by: 


A. Improving the documentation of the nature and resolution of the 
investigations, including referral to law enforcement when suspected 
recipient fraud is identified. 


B. Using state tax information to examine income and household 
composition information. 
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Chapter III — Improvements Needed to Help 
Address Medicaid Fraud by Providers 


Introduction 


A primary focus in ensuring the integrity of the Medicaid program is reducing and 
eliminating improper payments. An improper payment is any payment that should not 
have been made or that was made in an incorrect amount under the legally applicable 
requirements of the Medicaid program. Only a subset of improper payments are the 
result of fraud and abuse, as some may be the result of waste. The federal Centers for 
Medicare and Medicaid Services (CMS) estimates the national improper payment rate 
in Medicaid at approximately 10 percent, which may amount to millions of dollars 
annually. In fee-for-service (FFS) Medicaid programs, such as Montana Medicaid, 
participating Medicaid providers are paid for each delivered service for a recipient 
(e.g. an office visit, test, or procedure). In fiscal year 2017, Montana Medicaid providers 
were paid over $1.2 billion for benefits and claims, almost $400 million of which are 
from state funds. Many states largely center their program integrity activities around 
fraud, waste, and abuse by Medicaid providers, rather than by recipients. This is because 
providers are paid when participating in the Medicaid program, while recipients 
receive medical services. Additionally, as discussed earlier in this report, there is little 
cost-benefit when pursuing recipient fraud as repayment for services cannot be obtained 
from recipients who have committed fraud, nor are recipients convicted of Medicaid 
fraud disqualified from the program. This chapter provides information on program 
integrity efforts by the Montana Department of Public Health and Human Services 
(department) related to Medicaid providers, and discusses our recommendations for 


improvements in this area. 


Prevention of Medicaid Provider Fraud and Abuse 


Nationally, recent Medicaid program integrity initiatives have placed emphasis on 
implementing preventive controls, rather than attempting to recover overpayments to 
providers, which is commonly referred to as “pay and chase.” The two main preventive 
controls related to Medicaid providers in state Medicaid programs are: 1) preventing 
providers with intent to defraud the program from participating in Medicaid through 
effective provider screening and enrollment practices, and 2) preventing payment on 
potentially fraudulent claims submitted by providers. The following sections discuss 
these two controls and how they have been implemented in the Montana Medicaid 
program by the department. 
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Provider Screening and Enrollment 


Effective provider screening and enrollment is one of the most important preventive 
program integrity controls in Medicaid. In Montana, the Surveillance and Utilization 
Review Section (SURS) within the department’s Quality Assurance Division (QAD) 
works with a contractor to ensure the processes for provider screening and enrollment 
meet state and federal requirements. While the department issues licenses and 
certifications to providers, the contractor conducts the routine Medicaid provider 


screening and enrollment activities. 


Federal regulations require the department to obtain certain disclosures from providers 
applying to participate in Medicaid. These disclosures include information on provider 
ownership and control, business transactions, and persons convicted of crimes. The 
department must also establish categorical risk levels (limited, moderate, or high) for 
providers based on their financial risk for fraud, waste, or abuse. The department has 
opted to assign Montana providers to the risk level they were assigned to by CMS 
for Medicare, when applicable. Currently, the only provider types designated as high 
risk in Montana are newly-enrolling durable medical equipment suppliers and newly- 
enrolling home health agencies. These provider types have been designated high risk 
in Medicare and Medicaid because they offer services and supplies that are considered 
most vulnerable to fraud. 


States must screen Medicaid providers according to the fraud risk category to which 
they were assigned. Certain screening activities are required for all providers, regardless 
of risk level, while other screening activities only apply to those in the moderate or 
high risk categories. Table 2 summarizes the federally required screening activities by 
provider risk level. 


Table 2 
Required Medicaid Provider Screening Activities by Risk Level 


Screening Activities 
Disclosures regarding ownership and control 
Verification of licenses 
Database checks: 
-List of Excluded Individuals and Entities (LEIE) 
-National Provider Identified Registry 
-National Plan and Provider Enumeration System (NPPES) 
-Excluded Parties List System (EPLS)/System for Award Management (SAM) 
-Social Security Administration records and Death Master File 


Provider/Supplier-specific requirements 


Limited Risk 


Site visits 


Fingerprint-based criminal background check 


Source: Compiled by the Legislative Audit Division from federal requirements. 


The table shows that screening on all providers, regardless of risk level, must include 
provider disclosures, verification of licenses, database checks, and provider-specific 
screening. The databases checked during provider screening include various exclusion 
lists and identity verification databases. Only moderate and high risk providers are 
subject to on-site visits and only high risk providers are subject to fingerprint-based 
criminal background checks. It should be noted the department is permitted, in certain 
circumstances, to rely on screening activities conducted for enrollment in Medicare or 
for enrollment in other state Medicaid programs. This prevents the department from 
having to duplicate screening activities that have already been conducted. Audit work 
related to provider screening and enrollment is further discussed in the next section of 
this chapter. 


Initial Provider Screening and Enrollment Are 
Conducted According to Federal Requirements 


As part of audit work, we examined the department’s provider screening and enrollment 
processes through file review on a sample of Medicaid providers. We obtained our 
sample by first obtaining data on all active Medicaid providers in January 2018, which 
included approximately 22,000 Medicaid providers. We then selected a random 
sample of 100 providers, which consisted of 40 limited risk providers, 40 moderate 
risk providers, and 20 high risk providers. The sample included a mix of individual 
providers and organizations as well as a range of initial enrollment dates. 


Upon reviewing the enrollment files for the Medicaid providers in our sample, we 
determined the initial screening activities applicable to all provider types were 
conducted according to federal regulations. The screening activities we reviewed 
included obtaining provider ownership information, obtaining provider agreements, 
checking licensure status, and checking the required databases. We also verified 
that the additional screening activities for the moderate and high risk providers were 
conducted. Of the 40 moderate risk and 20 high risk providers in our provider sample, 
the department was able to rely on screening for Medicare for 34 of the moderate and 
19 of the high risk providers. For the remaining moderate and high risk providers, we 
found documentation of on-site visits conducted by the department and confirmed 
that a background check took place for the one high risk provider in our sample 
not enrolled in Medicare. These results indicated the initial provider screening and 
enrollment processes were conducted according to the requirements of the Medicaid 
program. 
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Prevention of Payment on Potentially Fraudulent Claims 


The second preventive control related to Medicaid providers is preventing potentially 
fraudulent claims from being paid. The department contracts for a Medicaid claims 
processing system known as the Medicaid Management Information System (MMIS). 
MMIS has hundreds of system controls, called edits, that prevent payment on many 
types of improperly billed claims. For example, an edit in MMIS would prevent 
payment on maternity care billed for a male recipient. The department is responsible 
for ensuring the contractor implements changes to MMIS as the rules surrounding 
Medicaid change. Department staff indicated it reviews new Medicaid codes quarterly 
to determine what limits should be included in MMIS, typically following the limits 
used for Medicare. The department then works with the contractor to design and test 
any new edits. 


OD 
CONCLUSION 


The department ensures the process for screening providers at initial 
enrollment is conducted according to the requirements of the Medicaid 
program, and the Medicaid Management Information System has system 
controls, called edits, to help prevent potentially fraudulent claims from being 
paid. 


Medicaid Providers Must Be Revalidated 
at Least Every Five Years 


Once a provider is enrolled, federal regulations require states to revalidate the 
enrollment of the provider, regardless of provider type, at least every five years. 
Provider revalidation consists of collecting updated ownership and control disclosures 
from enrolled providers as well as rescreening providers who have not been screened 
by Medicare or by another state’s Medicaid program within the previous 12 months. 
States were required by CMS to complete revalidation of all providers enrolling before 
March 2011 by September 2016. Providers enrolling after March 2011 did not have to 
be revalidated until five years from the date they were initially enrolled. 


Department Has Not Conducted Timely 
Revalidation of Medicaid Providers 


While the department has made continued efforts to comply with the five-year 
revalidation requirement, providers enrolling after March 2011 have yet to be 
revalidated. Medicaid provider data show there were around 1,500 providers who 


enrolled between April 2011 and March 2013. This represents the approximate 
number of Medicaid providers for which the department has not met the five-year 
revalidation requirement. The department recently completed the revalidation of 
Medicaid providers enrolling before March 2011 by contracting for a revalidation 
project with the MMIS contractor. The project was contracted at an estimated cost of 
$292,000. However, this revalidation effort did not meet the required September 2016 
deadline. When the department requested a waiver from CMS to extend the deadline, 
it was denied. 


The department indicated it did not meet the September 2016 deadline due to a 
lack of implementation of a sub-system within MMIS. The department is currently 
procuring a new module within MMIS to include provider enrollment and 
revalidation functions and intends to complete revalidation of existing providers as 
part of system implementation. The department expects to be caught up on remaining 
provider revalidations in 2019. Regular monitoring activities are being conducted in 
the meantime through monthly electronic screening of all Medicaid providers against 
various exclusion lists and verification databases. However, an important part of 
provider revalidation is collecting updated provider ownership and control information 
so the department can continue to identify providers and provider owners with recent 
sanctions or exclusions. Therefore, even with the regular monitoring activities, it is 


important that the department complete revalidation in a timely manner. 
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RECOMMENDATION #4 


We recommend the Department of Public Health and Human Services ensure 
providers enrolled in the Montana Medicaid program are revalidated at least 
every five years, as required by federal regulations. 


TT 


Medicaid Provider Overpayment Audits by the Department 


In addition to efforts around provider screening and enrollment, the SURS unit 
conducts retrospective audits on claims submitted by and paid to Medicaid 
providers in order to identify and recover erroneous payments. These are referred to 
as overpayment audits. The overall purpose of the overpayment audit process is to 
safeguard the Medicaid program from payment on claims due to fraud, waste, and 
abuse. Provider overpayments can result from a variety of circumstances ranging from 
lack of documentation related to services to billing for services not actually rendered. 
As with other Medicaid program integrity functions, the federal government affords 
states with great flexibility in carrying out provider overpayment audits. 
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Medicaid providers may be selected for review by SURS based on referrals, data 
mining, national trends, and whether the provider is new to the Medicaid program. 
Data mining is the process of identifying anomalies and patterns in data. In data 
mining overpayment audits, SURS queries claims including certain billing codes 
or services that are associated with known risk for billing errors. After selecting the 
provider for an audit, SURS staff query claims paid to the provider during a specified 
time frame from the MMIS. If necessary, records and other supporting documentation 
on claims may be requested of the provider. The records supplied by the provider are 
reviewed by SURS to determine whether the documentation supports the service 
billed and whether the billing followed the rules of the Medicaid program. Audits may 
result in no errors being found, provider education to correct billing errors, or in an 
overpayment with provider education. When an overpayment is identified, the audited 
provider may initiate an administrative review process to dispute the findings. In the 
case of suspected fraud, the SURS unit is required to refer the case to the Department 
of Justice’s Medicaid Fraud Control Unit (MFCU). MFCU would then investigate 


and potentially prosecute the case, depending on the results of its investigation. 


Overpayment Audits by the Department 

Focus on Newly Enrolled Providers 

As part of audit work, we reviewed a random sample of 110 overpayment audits 
conducted by SURS and closed during fiscal years 2016 and 2017. The sample included 
audits resulting in no overpayment and audits with varying established overpayment 
amounts. Based on our sample and interviews with department staff, it became evident 
that new provider reviews make up a large portion of overpayment audit efforts by 
SURS. Almost three-quarters of our sample were new provider reviews. Twelve were 
data mining audits and another ten were based on referrals from Medicaid program 
staff within the department. The remainder were other types of audits, such as referrals 
from a licensing board, referrals from the department’s contractor, or audits based on 
national trends. Figure 4 (see page 27) illustrates the reasons providers were selected 
for an overpayment audit and the percentages in which they occurred in our sample. 


Figure 4 
Reason for Provide Being Selected for Overpayment Audit by SURS 


*Other 

Referral from MMIS contractor (<1%) 
Referral from a licensing board (<1%) 
Referral from MFCU (<1%) 

Provider self-referral (<1%) 

Provider self-audit (<2%) 

National trends (<1%) 

No documentation on reason (<2%) 


Source: Compiled by the Legislative Audit Divisions from file review results. 


As Figure 4 shows, most of our sample was new provider reviews, demonstrating that 
SURS focuses on new providers when selecting providers to audit. The overpayments 
in our sample were due to errors made by the provider in billing, such as the incorrect 
usage of billing codes. Some overpayments occurred due to documentation from 
medical records that did not support the claims billed. However, because the sample 
consisted primarily of new provider reviews, patterns of potentially fraudulent billing 
behavior by established Medicaid providers were not apparent in the review. 


While there is some benefit to auditing new providers in regard to education and early 
identification of billing errors, focusing too much on new providers is not the most 
effective practice in identifying potential fraud and abuse. Focusing on new provider 
reviews limits the state’s ability to identify potentially fraudulent or abusive billing 
practices by more established providers who make up a larger percentage of overall 
Medicaid claims and payments. Interviews with CMS and Medicaid staff in other 
states indicated it is more common to take a risk-based approach in selecting providers 
to audit. For example, the majority of audits conducted in Wyoming are the result 
of data mining. Alaska uses software to consider several risk factors when selecting a 
provider for review, such as payments to the provider relative to other providers and 
average payment amount per claim. Vermont considers factors such as how likely it 
is to recover potential overpayments. While SURS is not currently using a risk-based 
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approach in selecting most of the providers it audits, the department indicated it is 
in the process of procuring a new sub-system within MMIS. This new sub-system 
is expected to have more analytical capacity related to overpayment audits. The 
department intends to have this sub-system in place in 2019. 


Department Does Not Systematically 
Conduct Follow-up Audits 


Following an initial overpayment audit, providers may be subject to a follow-up audit. 
According to SURS policy, the follow-up program will “review and prioritize previously 
audited providers of Medicaid services for re-audit of billing practices based on the 
number of errors found in initial audit and compliance with education based on audit 
findings.” This process is supposed to take place biannually. During our file review on 
a sample of overpayment audits, which raised questions about follow-up audits, SURS 
was unable to provide a list of providers eligible for a follow-up audit. We learned that 
follow-up audits are conducted infrequently by SURS when compared to new provider 
reviews and are not currently conducted in a trackable manner. When follow-up audits 
are not conducted in a systematic way, the state is not revisiting providers who have 
already shown signs of billing errors that could amount to potential fraud or abuse. 


Department’s Audit Processes Are Not Effective in 
Identifying Potential Medicaid Provider Fraud 


In fiscal year 2017, Montana Medicaid providers were paid over $1.2 billion in benefits 
and claims, almost $400 million of which came from state funding sources. Even 
if fraud, waste, and abuse account for only a small percentage of this, it amounts to 
millions of dollars in improper payments. With so much state and federal funding 
for Medicaid services, it is vital to safeguard the program from improper payments, 
including those due to fraud and abuse by providers. Nationally, the Government 
Accountability Office (GAO) estimated more than $29 billion in improper payments 
in Medicaid in 2015. If improper payments go undetected, including those associated 
with fraud or abuse, state and federal governments could be paying providers for 
services that were not provided or for unneeded services. When this happens, Medicaid 
funds are diverted from their intended purpose, beneficiaries who need services may 
not receive them, or beneficiaries may be harmed by unnecessary care. SURS currently 
focuses its efforts to identify improper payments on new provider reviews and does not 
systematically conduct follow-up audits on providers found to have significant billing 
errors. As discussed, these are not effective practices in identifying potential provider 
fraud or abuse in Medicaid billing. Therefore, the department should develop more 
effective overpayment audit processes to better identify potential provider fraud and 
abuse. 


a 


RECOMMENDATION #5 


We recommend the Department of Public Health and Human Services: 


A. Develop a risk-based approach in selecting Medicaid providers for 
overpayment audits, and 


B. Conduct follow-up audits of providers found to have significant billing 
errors in a regular, trackable manner. 


TL 


Recent Legislation Reduced the State’s Ability to Identify 
Overpayments and Potential Fraud and Abuse 


In Montana, recent legislation related to overpayment audits by the department and its 
contractors was passed. In the 2015 Legislative Session, House Bill 237 was passed by 
the legislature, but was vetoed by the governor. A similar bill was passed and enacted 
into state law in Chapter 82 in the 2017 Legislative Session. These two bills were put 
forward based on concerns by the Medicaid provider community in Montana related 
to large Medicaid overpayment amounts, large documentation requests, and lengthy 
audit time frames. Additionally, there was a perception that Montana Medicaid had 
relatively little provider fraud, waste, and abuse, due to a low state-level improper 
payment rate, called the Payment Error Rate Measurement (PERM). While CMS 
estimated Montana’s PERM rate to be 5.8 percent in fiscal year 2014 and the overall 
rate for the states in the same PERM cycle was 11 percent, states should take caution 
when comparing states’ PERM rates. Comparisons based solely on PERM rates are 
not encouraged due to variations in the sizes of states, program variations, and the 
different ways each state’s rate impacts the national PERM rate. 


The legislation put certain sideboards on overpayment audits by the department and 


its contractors, such as: 


¢ — Restricting records requests from providers to six months of claims within 
the previous three years for initial audits. 


¢ — Restricting follow-up audits of providers found to have a significant billing 
error rate in an initial audit to the same codes associated with errors from the 
initial audit. However, the department may request additional records from a 
lookback period longer than three years for a follow-up audit. 


¢ Requiring audits to be completed within 90 days of receiving records from 
providers, unless fraud is suspected. 


¢ — Prohibiting the projection of overpayment results from a sample to a larger 
set of claims (extrapolation) in an initial audit. 
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¢ — Requiring the department to obtain and consider a peer review, upon request 
by a provider, of overpayment audit findings. 


¢ Requiring annual publication of various statistics regarding all overpayment 
audits. 


¢ Requiring the department to annually evaluate auditor performance to 
include input from providers. 


Many of the provisions in the new law promote a more reasonable balance in the 
overpayment audit process. For example, prohibiting extrapolation in an initial 
audit prevents large overpayment amounts from being established based solely on 
unintentional clerical errors. However, the six-month restriction on records requests 
has resulted in, and is expected to further result in, negative impacts to the state’s 
ability to identify provider fraud, waste, and abuse. 


Other States Have Less Strict Records Request Restrictions 


Industry standards allow for longer time frames for records requests from providers. 
In our review of six other comparable state Medicaid programs, none of them had 
limitations on records requests for overpayment audits as strict as those of Montana. 
The states we reviewed included Alaska, Colorado, Idaho, South Dakota, Vermont, 
and Wyoming. The most limited records request restriction identified by another 
state was 12 months. Two of the states we interviewed permit records requests from 
providers on Medicaid claims from up to six years. Most of these states indicated a 
six-month restriction on records requests would greatly reduce their ability to identify 
legitimate overpayments. 


Additionally, states indicated a six-month records request restriction would reduce their 
ability to identify potential provider fraud, as six months of records is not typically 
enough to identify a potentially fraudulent billing pattern. This same concern was 
expressed by staff from the Montana MFCU. CMS representatives indicated that, 
while states have varying look-back periods and records request restrictions, they were 
not aware of other states with a records request restriction as strict as six months. CMS 
representatives also recognized that this level of restriction would impact the amount 
in overpayment a state can recover, particularly in smaller states. The true extent of the 
reduction in overpayment amounts in Montana is not yet known, as the department 
may receive the actual payment on overpayments that were established months or 
even years beforehand. However, department staff indicated future collection on 
overpayments will likely decrease. 
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Department Could Not Procure a 
Recovery Audit Contractor 


‘The six-month records request restriction also affects other program integrity measures 
in Montana. Federal regulations require states to contract for a Recovery Audit 
Contractor (RAC). The RAC program has been identified by CMS as a key anti-fraud 
and abuse activity that was expanded to Medicaid from Medicare. Medicaid RACs 
perform additional reviews of claims submitted by providers to identify improper 
payments and are paid based on a percentage of the overpayment they recover. This 
percentage was 10 percent in Montana. Figure 5 shows the amounts recovered in 
Medicaid overpayments by both SURS and the RAC between fiscal years 2013 and 
2017. 


Figure 5 
Overpayment Recoveries 


2015 2016 2017 2018 
(as of 1/31/18)* 


= SURS #RAC 


Source: Compiled by the Legislative Audit Division from department information. 


*No RAC. 


The figure shows the overpayment recoveries by the RAC became comparable to 
recoveries identified by SURS, even exceeding SURS recoveries during the most recent 
year in which the department contracted for a RAC. However, the department was 
unable to procure a new RAC after the most recent contract expired because of the 
six-month records request restriction in the new law. The department recently received 
a waiver for the RAC program from CMS, but this waiver expires August 7, 2019. 
‘Therefore, Montana is currently without the additional safeguard of the Medicaid 
program by a RAC. 
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Changes to the Law on Overpayment Audits Are Needed 


Nationally, state Medicaid programs face challenges in balancing program integrity 
control activities with preventing these controls from discouraging honest providers 
from participating in Medicaid. When fewer providers are willing to participate in 
Medicaid, program recipients may not have sufficient access to needed medical 
services. It is important, however, to ensure the reduction of provider burden is done 
in a manner that preserves the state’s ability to safeguard the Medicaid program from 
fraud, waste, and abuse. Therefore, while many provisions in the recent state law on 
overpayment audits reduce the administrative burden on Medicaid providers, audit 
work determined the six-month records restriction provision unnecessarily reduces the 
state’s ability to identify provider fraud, waste, and abuse. Audit work determined the 
department needs access to at least one year of provider records to sufficiently identify 
patterns of fraudulent billing. On the other hand, we recognize there may be certain 
types of audits for which the department may want to request less than a year’s worth 
of records, such as for new provider reviews. Therefore, if the department did have 
the option to request more than six months of records from providers, it still has the 
option to request fewer records for certain types of audits. 


RECOMMENDATION #6 


We recommend the Montana Legislature amend state law to allow the 
Department of Public Health and Human Services and its contractors to 
request at least one year of records from Medicaid providers for overpayment 
audits. 


To 


Chapter IV — Coordination in 
Program Integrity Efforts 


Introduction 


The laws, rules, policies, and best practices surrounding Medicaid exist at the federal 
and state levels. Because of this, the Medicaid program is complex and the roles in 
program integrity efforts have blurred over time. Coordinated efforts both within the 
Department of Public Health and Human Services (department) and between the 
department, its contractors, and other state functions are vital to ensuring the integrity 
of the Medicaid program. One of our audit objectives was to determine whether 
reasonable coordination of efforts exists in Montana in safeguarding the Medicaid 
program from fraud and abuse. 


The majority of states’ strategies to combat fraud and abuse in Medicaid largely focus 
on providers, rather than recipients. This may be due to the nature of the Medicaid 
program in the sense that Medicaid providers receive payments for providing services, 
and therefore may have more incentive to defraud or abuse the program. Additionally, 
the cost-benefit to the state in pursuing potential Medicaid recipient fraud may be 
lower than in pursuing Medicaid provider fraud and abuse. Because of this, we 
largely focused our review on the coordination of efforts in identifying and pursuing 
Medicaid fraud and abuse by providers. While our previous chapter focused on 
improvements the department could make to better identify potential fraud and abuse 
by providers, this chapter provides our recommendation for improving coordination in 
state efforts to mitigate the risk of provider fraud and abuse in the Medicaid program. 
Our work found that, while the department has controls in place to ensure reasonable 
coordination of Medicaid program integrity efforts, the department needs to develop 
an overall strategy for combatting provider fraud and abuse in the Medicaid program. 


Coordination Between the Department and the Contractor 


Since Medicaid in Montana is administered through many contracted services, 
coordination between the department and its contractors is important in safeguarding 
Medicaid from provider fraud and abuse. Some coordination in this area exists in the 
Medicaid provider screening and enrollment processes. The department contracts for 
a Medicaid claims processing and payment system called the Medicaid Management 
Information System (MMIS). The MMIS contains a sub-system for the screening 
and enrollment of Medicaid providers. The contractor performs the routine provider 
screening and enrollment activities within the sub-system, such as the intake, screening, 
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approval, and final review of applications. However, some provider types require 
approval from the department to enroll in Medicaid. For example, newly-enrolling 
home health agencies, considered high risk for fraud, require approval by the program 
officer within the department before their applications can be approved within the 
provider sub-system. 


As part of the enrollment process, Medicaid providers are electronically screened by 
the contractor at initial enrollment and monthly thereafter against various exclusion 
lists and verification databases. If inconsistencies or sanctions against the provider are 
identified, an alert is generated. The contractor addresses most of the alerts, though 
an alert is sent to the Surveillance and Utilization Review Section (SURS) within 
the department if it is for a sanction on the provider within the last three years. 
While our file review work on a random sample of 100 Medicaid providers did not 
include any providers with alerts that warranted being worked by SURS, we obtained 
documentation that alerts are being sent to and addressed by the department when 


necessary. 


In addition, contract oversight activities by the department include monthly reporting 
by the contractor on certain performance criteria. Some of these performance criteria, 
jointly developed by the department and the contractor, pertain to provider screening 
and enrollment. For example, one criterion is that alerts generated during the monthly 
screening of providers are either worked by the contractor or referred to SURS within 
ten days. The contractor’s report from September 2017 indicated it met this performance 
criterion. Based on our review, we determined that reasonable coordination between 


the department and the contractor exists regarding program integrity efforts. 


Coordination Within the Department 


Medicaid program integrity efforts span multiple divisions and functions within the 
department. As such, coordination within the department is key to ensuring provider 
fraud and abuse is properly identified and pursued. This section describes some of the 
other coordinated efforts we identified within the department. 


SURS conducts audits of paid claims in order to identify provider overpayments due to 
fraud, waste, or abuse. However, other divisions within the department are responsible 
for administering the various Medicaid programs within Montana Medicaid, including 
the Senior and Long Term Care Division, the Developmental Services Division, the 
Addictive and Mental Disorders Division, and the Health Resources Division. These 
divisions review claim reports from the MMIS and may refer audit topics or individual 
providers to SURS based on spikes in these reports or other observations in the field. 
We reviewed 110 overpayment audits by SURS and found that 10 of them were based 
on referrals from these divisions, indicating these types of referrals are being made. 


The SURS overpayment audit process also includes a review by the Medicaid Review 
Committee (MRC) for provider overpayments of more than $5,000. The MRC reviews 
overpayment findings and votes on the resolution of cases, including consideration as 
to whether fraud may have occurred. The voting process is currently conducted via 
e-mail in order to complete overpayment audits within the required 90 days specified 
in state law. The MRC is made up of staff from QAD, other department divisions, and 
the Medicaid Fraud Control Unit (MFCU) within the Department of Justice. The 


voting and nonvoting members are listed below. 


Voting members: 
¢ = QAD Administrator 
¢ QAD Program Compliance Bureau Chief 
¢ Human Resources Division Administrator (or designee) 
¢ — Addictive and Mental Disorders Division Administrator (or designee) 
¢ — Senior and Long Term Care Division Administrator (or designee) 
¢ Developmental Services Division Administrator (or designee) 
¢ The Bureau Chief from the affected Medicaid program 
¢ Senior Medicaid Policy Officer 


Nonvoting members: 
¢ MRC meeting coordinator (designated SURS staff) 
¢ —SURS Supervisor 
¢ —SURS auditor responsible for the case being presented 
¢ Program Officer or Program Manager associated with case 
¢ ~=MFCU Supervisor 
¢ ~~ Chief of the Office of Legal Affairs (or designee) 


The MRC provides a coordinated approach in the overpayment audit process and 
allows the department to consider how large overpayments may impact providers and 
access to Medicaid services by recipients. ‘That is, a provider may be the only Medicaid 
provider in a rural community. A large overpayment may affect such a provider's 
willingness and ability to accept Medicaid patients and therefore would affect access to 
Medicaid services for recipients in the area. However, access to services does not affect 
consideration as to whether suspected fraud has occurred and is referred to MFCU. 
Additionally, the MRC allows an opportunity to identify needed clarifications or 
changes in the department’s administrative rules for Medicaid billing. Medicaid staff 
from the six other states we interviewed during the audit indicated program divisions 
are informed and included to various extents on overpayment audit issues. 
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Coordination Between the Department and 
the Medicaid Fraud Control Unit 


Federal regulations require the department to refer all cases of suspected provider 
fraud to the state MFCU within the Montana Department of Justice. If an allegation 
of fraud is then established as credible, the department must suspend Medicaid 
payment to the provider, though there are certain exceptions. The department has 
established an agreement with MFCU detailing each party’s responsibilities in regard 
to pursuing potential Medicaid provider fraud. For example, the agreement states the 
department will provide MFCU with access to the records and information needed 
for investigations by MFCU. The agreement also establishes a MFCU representative 
as a nonvoting member of the MRC process. Additionally, MFCU and SURS conduct 
cross-trainings about every other month on various topics, such as training on querying 
claims from MMIS. The SURS unit and MFCU share information on cases that are 
open and being worked in order to prevent duplication of effort. 


Decline in Referrals to MFCU 


There have been recent concerns about the decline in referrals to MFCU from the 
department. For example, a 2013 review of Montana’s SURS unit by the Centers for 
Medicare and Medicaid Services (CMS) identified several risks to Medicaid program 
integrity, including a low number of referrals to MFCU. Figure 6 shows the history 
of the number of referrals to MFCU by SURS and from other areas within the 
department. 


Figure 6 
Referrals to the Medicaid Fraud Control Unit by the Department 
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Source: Compiled by the Legislative Audit Division from MFCU data. 


Figure 6 shows the number of referrals to MFCU from the department began to decline 
around 2009. Referrals from the department went from around 20 to 30 referrals per 
year in the early 2000s to around six referrals per year in recent years. 


Per department staff, there may be several factors that have contributed to this decline 
in referrals. For example, department management indicated there was some initial 
concern from staff related to the impact of restricting records requests from providers 
to six months in terms of demonstrating enough evidence to refer a case to MFCU. 
However, the six-month restriction in overpayment audits in the law and in practice by 
SURS occurred after the decline in referrals. Improvements to MMIS during this time 
frame may have also included preventive controls that contribute to fewer instances 
of provider fraud, though this would not entirely explain why decline in referrals 
occurred. 


A recent Legislative Audit Division financial-compliance audit (#17-14) identified that 
SURS had been misinterpreting the distinction between the level of proof necessary 
to constitute “suspected fraud” versus a “credible allegation of fraud.” Cross-training 
documents between SURS and MFCU indicated this is a potential topic for further 
training, and the department has moved toward more informal communication with 
MECU prior to a formal written referral. Department staff also indicated they were in 
the process of reviewing the department's policies, processes, and the agreement with 
MEFCU to address this recommendation from the financial-compliance audit (#17-14). 
This indicated the department is making a concerted effort to address the areas under 
its control that may factor into this decline in referrals to MFCU. In addition, the 
implementation of earlier recommendations in this report may also lead to an increased 
number of referrals to MFCU by the department. Therefore, we determined reasonable 
coordination exists between the department and MFCU. 


a 
CONCLUSION 


We conclude the department has controls in place to ensure reasonable 
coordination of Medicaid program integrity efforts across state functions in 
accordance with federal and state requirements and best practices. 


Department Has No Overall Program Integrity Strategy 


While coordination of efforts across state functions exists, the department does not 
have an overall strategy for addressing fraud and abuse in the Medicaid program. 
Multiple factors contribute to the lack of an overall strategy by the department. For 
example, audit work determined there has been a general shift in department policy 
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and processes that makes the department’s program integrity activities less onerous for 
Medicaid providers. Interviews with department staff indicated the department has 
made an effort to be less burdensome on providers across Medicaid divisions, primarily 
due to a large provider overpayment that had been identified. Interviews with provider 
groups and the department also indicated the large overpayment precipitated many of 
the provisions in the new law on overpayments. Additionally, program divisions were 
instructed by management to cease conducting informal reviews of providers from a 
clinical perspective due to the large overpayment. SURS staff were also directed to find 
alternatives in its overpayment processes to be less punitive on providers. This was, at 
least in part, due to the passage of the legislation that put sideboards on overpayment 
audits. 


Another reason an overall strategy related to Medicaid fraud and abuse did not exist 
was that it may not have been at the forefront of the department’s objectives. That 
is, the department may not have prioritized a comprehensive anti-fraud strategy. For 
example, the department had to implement the expansion of Medicaid, which involved 
enrolling over 90,000 people into the program. In order to provide access to services 
for the newly-eligible population, in addition to maintaining the traditional Medicaid 
programs, the department may not have prioritized or had the resources to develop 
an overall anti-fraud strategy. Over half of the eligibility workers who responded to 
our survey disagreed that identifying Medicaid recipient fraud and abuse was a high 
priority in the department. 


MFCU staff also indicated the department emphasizes protecting providers and 
preserving access to services for Medicaid recipients, which may have contributed to 
a decline in referrals from the department to the MFCU. The department could not 
provide a complete explanation as to why referrals to MFCU have declined over time. 
This speaks to how the department does not have a complete understanding of the 
potential cumulative effects of policy and other changes on risk for fraud and abuse in 
the Medicaid program. 


Increased Risk for Fraud and Abuse Makes 
an Overall Strategy Necessary 


Several factors in Montana contribute to an increased risk for fraud and abuse in 
Medicaid, which warrants an overall strategy by the department for combatting provider 
fraud and abuse. In Montana, Medicaid services are provided on a fee-for-service 
basis in which providers are paid for each service rendered (e.g. an office visit, test, or 
procedure). With the expansion of Medicaid covering an additional 90,000 recipients, 
more services are being delivered by providers, meaning more Medicaid dollars are 


being spent and there is an increased risk for fraud and abuse in the program. At the 
same time, the department has made an effort to be less burdensome on Medicaid 
providers based on concern from the provider community, leading to the passage of 
legislation on overpayment audits. This legislation not only reduced the ability of SURS 
to identify overpayments and potential provider fraud, but it led to an unsuccessful 
procurement of a Recovery Audit Contractor (RAC). The RAC had recovered more 
than $2 million in fiscal year 2017 and is an important mechanism for identifying 
and recovering improper Medicaid payments to providers. Therefore, fewer safeguards 
against provider fraud and abuse exist, leading to increased risk. 


Medicaid program integrity requires a balance between reducing improper payments 
and discouraging honest and qualified providers from accepting Medicaid-insured 
patients. Concern over placing undue burden on providers, the majority of whom 
are presumed to be honest, is a counterforce to program integrity activities. Part of 
ensuring the appropriate balance includes effective fraud risk management. 


The Government Accountability Office (GAO) issued a Fraud Risk Framework, 
which includes a fraud risk assessment and a risk-based anti-fraud strategy. The GAO 
identifies the components of an effective fraud risk framework as: 


¢ Committing to combatting fraud by creating an organizational culture and 
structure conducive to fraud risk management. 


¢ Planning regular fraud risk assessments and assessing risks to determine a 


fraud risk profile. 


¢ Designing and implementing a strategy with specific control activities 
to mitigate assessed fraud risks and collaborate to help ensure effective 
implementation. 


¢ Evaluating outcomes using a risk-based approach and adapting activities to 
improve fraud risk management. 


Based on our review of department information and discussions with department 
officials, we determined the department has not fully developed an overall strategy 
in regard to detecting and deterring provider fraud and abuse in Medicaid. The 
department does not have a formal risk assessment process and has not assessed the 
cumulative effects of policy and other changes to risk for Medicaid provider fraud 
and abuse in Montana. Therefore, the department needs to develop a comprehensive 
fraud risk framework for Medicaid. This requires an assessment of existing risks and 
an evaluation of how policy changes affect the risk for Medicaid provider fraud and 
abuse in Montana in order to promote processes that are conducive to identifying and 
pursuing fraud and abuse. When the department does not have a fraud risk framework 
or an overall strategy for addressing provider fraud and abuse, the department may not 
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be placing its program integrity controls where the highest risks exist. This could result 
in provider fraud and abuse in Medicaid going undetected by the department at cost 
to state and federal taxpayers. 


ee 


RECOMMENDATION #7 


We recommend the Department of Public Health and Human Services 
develop a fraud risk framework for Montana Medicaid to design an overall 
strategy related to Medicaid provider fraud and abuse. This is to include: 


A. A strategic plan for promoting processes to identify and pursue Medicaid 
provider fraud and abuse. 


B. An ongoing means for assessing existing risks through an evaluation of 
how policy changes affect Medicaid fraud and abuse. 
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Angus Maciver 


Legislative Auditor 

Office of the Legislative Auditor 
State Capitol, Room 160 
Helena, Montana 59620-1705 


Re: Performance Medicaid Audit 
Dear Mr. Maciver: 


The Department of Public Health and Human Services has reviewed the Performance 
Medicaid Audit (17P-02) completed by the Legislative Audit Division. Our responses and 
corrective action plans for each recommendation are provided below. 


Recommendation #1: 
We recommend the Department of Public Health and Human Services conduct, document, 
and report on a re-evaluation of its current policy decisions on Medicaid recipient eligibility 
verification. Re-evaluations should: 

A. Identify risks for Medicaid recipient fraud and abuse, analyze how policy decisions 


impact those risks, and determine whether it is feasible to reduce those risks through 
policy or procedural changes. 


B. Include policies such as post-enrollment verification of income, coordination with 
the federally-facilitated marketplace, and continuous eligibility. 


C. Reoccur on a systematic basis when the requirements of the Medicaid program 
change. 


Response: Concur 
Corrective Action: The Department will conduct a re-evaluation of its policy decisions 


and document considerations, analysis and conclusions. Policy change evaluation and 
documentation will be incorporated into change management processes going forward. 


Planned Completion Date: December 31, 2018 
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Recommendation #2: 

We recommend the Department of Health and Human Services incorporate training for 
Medicaid eligibility workers on identifying and referring suspected Medicaid recipient 
fraud or abuse into its ongoing training plan. 


Response: Concur 


Corrective Action: 

This was implemented with refresher training in November 2017 for all staff. The refresher 
training is available to all staff at all times via our eLearn platform. A fraud waste and 
abuse module is included in new hire training for eligibility staff. 


Planned Completion Date: Completed 


Recommendation #3: 
We recommend the Department of Public Health and Human Services enhance 
investigations into complaints of Medicaid recipient fraud by: 

A. Improving the documentation on the nature and resolution of the investigations, 


including referral to law enforcement when suspected recipient fraud is identified. 


B. Using state tax information to examine income and household composition 
information. 


Response: Partially concur 


Corrective Action: 

Quality Assurance Division, Program Investigation Unit will work with Human 
Community Services Division (HCSD) to receive Medicaid eligibility training for the 
Program Integrity Investigators (PII). Training will include modules through the eLearn 
training environment. The additional training will enhance the PII’s ability to identify and 
investigate Medicaid recipient fraud. A separate, internal training will be held to reinforce 
the importance of complete and accurate case documentation. 


The Program Investigation Supervisor will reach out to law enforcement and county 
attorney associations to discuss the necessary components required for potential criminal 
prosecution. Following these discussions, updated internal procedures will be 
implemented. 


The Department agrees access to a recipient’s state tax returns would be a useful tool in 
the investigation process. However, DPHHS Office of Legal Affairs and the Department 
of Revenue Legal Department have determined that under the current laws, DPHHS is not 
legally permitted to receive tax information from the Department of Revenue without a 


court order or a comprehensive restructuring of statutes, rules, and internal policies. The 
Department will continue to look for avenues for verifying application information. 


Planned Completion Date: December 31, 2018 


Recommendation #4: 

We recommend the Department of Health and Human Services ensure providers enrolled 
in the Montana Medicaid program are revalidated at least every five years, as required by 
federal regulations. 


Response: Concur 


Corrective Action: 

DPHHS has processes in place to assure providers are adequately screened and monitored 
while working toward full compliance of revalidating all providers at least every five years. 
The Department will also require all providers to revalidate their information within the 
required timeframe through the provider enrollment and maintenance services currently 
under procurement. The Department anticipates implementation of the service module — 
which will require providers to revalidate — to be complete by August 2019. 


Planned Completion Date: August 1, 2019 


Recommendation #5: 
We recommend the Department of Public Health and Human Services: 
A. Develop a risk-based approach in selecting Medicaid providers for overpayment 


audits and 


B. Conduct follow-up audits of providers found to have significant billing errors in a 
regular, trackable manner. 


Response: Concur 


Corrective Action: 

The Surveillance, and Utilization Review Section (SURS), Quality Assurance Division, 
will create and identify a manual risk based analysis using the systems currently in place. 
Utilizing the fiscal agents Query Path program, SURS will run aggregate queries that will 
yield basic information. In addition, SURS will work with the Strategic Planning, 
Research, and Analysis team within the department to identify anomalies in payments to 
providers. 
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More sophisticated data analytics will be a feature of the MPATH modularity sub-system 
designed to perform complex algorithms on Medicaid payment data. 


To identify providers for follow-up audits, a list of provider reviews that concluded with a 
5% or more error rate will be compiled. Program Integrity Compliance Specialists will be 
given the expectation to open a minimum of two follow up reviews per month, as the list 
supports. 


Planned Completion Date: September 30, 2018 


Recommendation #6: 

We recommend the Montana Legislature amend state law to allow the Department of 
Health and Human Services and its contractors to request at least one year of records from 
Medicaid providers for overpayment audits. 


Response: N/A 
Corrective Action: N/A 


Planned Completion Date: N/A 


Recommendation #7: 
We recommend the Department of Health and Human Services develop a fraud risk 
framework for Montana Medicaid to design an overall strategy related to Medicaid 
provider fraud and abuse. This is to include: 

A. A strategic plan for promoting processes to identify and pursue Medicaid provider 


fraud and abuse. 
B. An ongoing means for assessing existing risks through an evaluation of how policy 
changes affect Medicaid fraud and abuse. 
Response: Concur 
Corrective Action: 
The Department will include a fraud risk framework in the Department’s strategic planning 


process. 


Planned Completion Date: December 31, 2018 


If you have any questions regarding our response, please contact Erica Johnston, 


Operations Services Branch Manager, at (406) 444-9773. 


Sincerely, 


. a 
___~Sheila Hogan, Director 
Department of Public Health and Human Services 


co: 

Laura Smith, Economic Security Services Branch Manager 

Marie Matthews, Medicaid & Health Services Branch Manager 

Erica Johnston, Operation Services Branch Manager 

Jamie Palagi, Human and Community Services Division Administrator 

Michelle Truax, Program Compliance Bureau Chief, Quality Assurance Division 
Gene Hermanson, Medicaid Systems Operations Manager, Medicaid Systems Support 
Chad Hultin, Audit Liaison, Operations Services Division 
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